Asterisk IAX2认证响应信息泄露漏洞

BUGTRAQ ID: 33174 CVECAN ID: CVE-2009-0041 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 Asterisk IAX2在认证期间对用户不存在的情况和错误口令的情况提供了不同的响应，这允许攻击者通过扫描主机确定特定的用户。 Asterisk Asterisk 1.6.x Asterisk Asterisk 1.4.x Asterisk Asterisk 1.2.x Asterisk Business Edition C.2.x.x Asterisk Business Edition C.1.x.x Asterisk...

Asterisk user account enumeration

Different replies for invalid username and password in IAX2 authentication...

AST-2009-001: Information leak in IAX2 authentication

Asterisk Project Security Advisory - AST-2009-001 +------------------------------------------------------------------------+ | Product | Asterisk | |----------------------+-------------------------------------------------| | Summary | Information leak in IAX2 authentication |...

CVE-2008-5558

Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service crash via authentication attempts involving 1 an unknown user or 2 a user using hostname matching...

Code injection

Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service crash via authentication attempts involving 1 an unknown user or 2 a user using hostname matching...

DEBIAN-CVE-2008-5558

Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service crash via authentication attempts involving 1 an unknown user or 2 a user using hostname matching...

CVE-2008-5558

Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service crash via authentication attempts involving 1 an unknown user or 2 a user using hostname matching...

CVE-2008-5558

Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service crash via authentication attempts involving 1 an unknown user or 2 a user using hostname matching...

CVE-2008-5558

Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service crash via authentication attempts involving 1 an unknown user or 2 a user using hostname matching...

CVE-2008-5558

CVE-2008-5558 affects Asterisk Open Source 1.2.26–1.2.30.3 and related Business Edition 2.3.5–2.5.5 when realtime IAX2 users are enabled. The vulnerability allows remote attackers to cause a denial of service (crash) during authentication attempts with an unknown user or with a hostname-matching ...

CVE-2008-5558

Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service crash via authentication attempts involving 1 an unknown user or 2 a user using hostname matching...

CVE-2008-5558: Improper Authentication

Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service crash via authentication attempts involving 1 an unknown user or 2 a user using hostname matching...

AST-2008-012: Remote crash vulnerability in IAX2

Asterisk Project Security Advisory - AST-2008-012 +------------------------------------------------------------------------+ | Product | Asterisk | |----------------------+-------------------------------------------------| | Summary | Remote crash vulnerability in IAX2 |...

Asterisk voice server DoS

Crash on IAX2 processing...

iax2-version NSE Script

Detects the UDP IAX2 service. The script sends an Inter-Asterisk eXchange IAX Revision 2 Control Frame POKE request and checks for a proper response. This protocol is used to enable VoIP connections between servers as well as client-server communication. Example Usage nmap -sU -sV -p 4569 Script...

Asterisk DoS

Resources exhaustion on IAX request parsing...

Additional Unresolved Asterisk IAX 0day..

Hello Again, There is an additional Asterisk IAX Resource Exhaustion DoS 0day. http://www.voip0day.com/news/asterisk-nsfw/ http://securityscraper.com/ Be advised, Asterisk is not safe for work. Kind Regards, Blake Cornell...

Asterisk multiple DoS conditions

Application crashes on malformed IAX requests flood...

Additional Asterisk Resource Exhaustion DoS Vulnerabilities

Hello, There are additional Asterisk RE Vulnerabilities. They are much like the IAX POKE vulnerability except these make Asterisk segfault signal 11 when call numbers are exhausted. http://www.securityscraper.com/pingpoke/iaxControlNewAuthmethods.txt...

Gentoo Security Advisory GLSA 200610-15 (asterisk)

The remote host is missing updates announced in advisory GLSA 200610-15. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...